voltry-evidence-schema 1.1.0

Voltry evidence bundle — THE contract. Typed models, RFC 8785 canonical serialization, ECDSA P-384 sign/verify, generated JSON Schema.

voltry-evidence-schema

The Voltry evidence bundle: the signed contract behind every Voltry Probe scan and certificate.

Note the naming: the PyPI distribution is voltry-evidence-schema, the Python package you import is evidence_schema.

pip install voltry-evidence-schema

import evidence_schema

What it provides

• Typed pydantic v2 models (EvidenceBundle and its blocks). Measured facts and modeled estimates are distinct types by construction; there is no single score anywhere in the schema, and no price field exists.
• One canonical serializer: RFC 8785 (JCS) over the bundle minus its signature. This is the only path to signable bytes.
• ECDSA P-384 (secp384r1) with SHA-384 sign and verify over those canonical bytes.
• A generated JSON Schema for cross-language consumers.

Quick start

import json
from evidence_schema import EvidenceBundle, verify_bundle

bundle = EvidenceBundle.model_validate(json.load(open("bundle.json")))
print(verify_bundle(bundle))  # True only if the signature covers these exact bytes

Command line:

# Round-trip demo: build, canonicalize, sign, verify, tamper, verify fails
python -m evidence_schema.demo

# Emit the JSON Schema for non-Python consumers
evidence-schema-jsonschema -o evidence_bundle.schema.json

Stability

The schema is versioned semantically and the 1.x line is frozen wide: a bundle captured today remains valid and replayable indefinitely. Additive fields are minor versions; anything breaking is a major version with a migration path. Canonical bytes are covered by golden-vector tests on every supported Python version (3.10 through 3.13).

License

Apache-2.0.